5 ms·

Summary please. It's a lengthy document with quite complex language. The impression I got from reading the introduction is it was pretty clear which way the r

Summary please. It's a lengthy document with quite complex language. The impression I got from reading the introduction is it was pretty clear which way the ruling went, but some of the comments here seem to be based on the opposite so there seems to be some confusion. So please can someone please sum it up in 1 or 2 lines?

1vuio0pswjnm7 5y ago
"[E]xceed[ing] authorised access" (EAA) may occur where information accessed is located in "areas of the computer that are off-limits", e.g., "files, folders, databases". Access for an unauthorised purpose does not amount to EAA. I was aiming for 160 chars (2 lines of 80 chars). Not so easy.
smsm42 5y ago
The question was if you accessed the data which you are authorized to access (like police database for a policeman) but then used it for the purposes which are not part of your duties (like a corrupt policeman selling these data to criminals) can you be charged under CFAA. The SCOTUS said no, if you are authorized, then you are authorized, and the fact that you used the data later for an unauthorized purpose does not make the access itself a crime under CFAA (still could be a crime under a different law, of course). Thus, they restricted the reading of CFAA to a much narrower scope than the government wanted to apply.
- smsm42 5y ago
  Also this probably blows a huge hole in the "EULA violation is a CFAA crime" argument. I'd say it probably would not survive this decision.
rswail 5y ago
if (not authorized && access system) { // unauthorized access = crime } else (if authorized && access system && access data && (authorized to access data && only under certain circumstances)) { // FBI/prosecution said = crime // SCOTUS said if authorized to access, but not in circumstances, // then ! crime under CFAA but may be crime under other laws } Basically, it comes down to that the system let the user access the data, but their conditions of use where that they were only allowed to do it under certain situations (in this case, as a cop, when involved in a traffic stop, or some other activity). The prosecution tried to say that this was a crime under CFAA, SCOTUS said that if the user is allowed to access the data, then it's not a breach of CFAA to do so.

1vuio0pswjnm7 5y ago

"[E]xceed[ing] authorised access" (EAA) may occur where information accessed is located in "areas of the computer that are off-limits", e.g., "files, folders, databases". Access for an unauthorised purpose does not amount to EAA. I was aiming for 160 chars (2 lines of 80 chars). Not so easy.

smsm42 5y ago

The question was if you accessed the data which you are authorized to access (like police database for a policeman) but then used it for the purposes which are not part of your duties (like a corrupt policeman selling these data to criminals) can you be charged under CFAA. The SCOTUS said no, if you are authorized, then you are authorized, and the fact that you used the data later for an unauthorized purpose does not make the access itself a crime under CFAA (still could be a crime under a different law, of course). Thus, they restricted the reading of CFAA to a much narrower scope than the government wanted to apply.

smsm42 5y ago
Also this probably blows a huge hole in the "EULA violation is a CFAA crime" argument. I'd say it probably would not survive this decision.

rswail 5y ago

if (not authorized && access system) { // unauthorized access = crime } else (if authorized && access system && access data && (authorized to access data && only under certain circumstances)) { // FBI/prosecution said = crime // SCOTUS said if authorized to access, but not in circumstances, // then ! crime under CFAA but may be crime under other laws } Basically, it comes down to that the system let the user access the data, but their conditions of use where that they were only allowed to do it under certain situations (in this case, as a cop, when involved in a traffic stop, or some other activity). The prosecution tried to say that this was a crime under CFAA, SCOTUS said that if the user is allowed to access the data, then it's not a breach of CFAA to do so.